0
Computer crash and how to recover
02 September 2006
[indent]You never realize how fragile your computer system really is until you’ve had a crash.
Last Saturday, a P4 system in the store, a computer that has worked flawlessly for the past year and a bit, refused to boot.
was the message on the screen. Argh!
I had never heard of this particular error (Windows has some many, keeping track of a few seems to occupy most of my effort...), but files do get corrupt. These files are constantly updated by Windows to track how everything is put together on your system, so they are particularly vulnerable to write errors I suppose.
The next screen advised me to use the repair feature on the Windows CD, but that has limitations, not least of all that it can act like a time machine and send you back to your first moment of installation (and that means having to re-install pretty much everything on your system, from patches to applications).
My newest computer allows up to 8 IDE devices, not the standard four that most PCs have. These extra IDE devices are controlled through a second chip on the motherboard, not through the BIOS. Windows’ repair feature can only see the BIOS devices, so my hard drive was invisible to it. The repair console couldn't find the damned drive!
Windows wouldn’t boot, so the system restore feature was equally unattainable. I needed to find another solution.
This was critical because the computer in question was not only the repository of my accounting and financial data, but it also contained the hard disk of customer files – artwork, graphics, business cards, and many ongoing projects. I had backups, but they were usually done on the weekend – and the computer failed Saturday. A week’s worth of work and data - and maybe more - was lost unless I could recover it.
I started searching online. I had expected this was a rare event, like winning the lottery in reverse. Instead, I discovered hundreds of entries about it; on forums I read dozens of tales of woe about people encountering this crash, plus pages of repair advice such as Schrock Innovations and Kelly's Korner, even a blog site about it.
Microsoft has a page on fixing it: five pages of mind-numbing technical data and instructions the average person would probably not comprehend. These instructions include accessing the normally hidden and inaccessible “System Volume Information” folder, which is one of those areas even technophiles fear to tread. Even the 'simplifed' instructions on other sites were awash in geek-ese. What the hell is a "software hive"? It sounds like insects are living in my computer!
For something that requires a modestly complex resurrection method and a healthy technical aptitude, this appears to be a fairly common event. On many technical forums it was one of the hot topics, with lots of useless palaver, but not much help. I had to sift through reply after reply until I could find clues as to how I might restore everything, and then carefully compare the instructions to make sure nothing was omitted or lost in translation.
First, I removed the drive and placed it into another computer as a slave drive, then checked its integrity for bad sectors. Fortunately, the hardware was okay. The files Windows kept saying were missing or corrupt were there, on the drive, easily visible in Explorer, so the problem must have been internal to one of them.
I took the opportunity at this point to copy critical data such as my accounting database, and my customer files, over to other computers on my network, just in case. Programs I can always re-install, but data I can't reconstruct, or can't do so without an enormous amount of effort.
Following Microsoft's instructions, I renamed the old CONFIG directory and copied files from Windows’ backup CONFIG directory (c:\windows\repair\). But te files there are dated from when I first installed Win XP. This got me thinking about what I was doing here.
The problem with this approach is that it overwrites all your data with basic or older system files that have no information about your current system: all your applications become 'uninstalled,' all your network connections are lost, and previously happy hardware vanishes… it requires restoring and re-installing pretty much everything from scratch. That would take many, many hours. If you reboot at this point, you can end up back at the point where you first installed Windows XP.
Instead, I had to dive into the System Volume Information (SVI) folder, where the secret repository of system restore data is hidden. This isn’t easy, because Windows resists all efforts to unlock it on any drive, not merely the boot drive.
Once again I had to surf over to Microsoft for some help on just how to do this.
Changing the SVI folder settings requires first making hidden files visible, then using a command-line attribute change to be able to open it. This has to be done in a CMD window and you need to know the name of the user who will be doing this. The command line to unlock the SIV folder is this:
Type it like that, changing drivename to your main drive letter (usually C:) and the username to whatever that is (when you open the CMD window, it usually starts in the document folder, so the name of the current user is probably in the command prompt line). Don't forget the quote marks around the name and username (if you have problems, drop the quotes from the username, but I have found they are necessary).
The SVI folder is a lot like the registry: full of files and data incomprehensible to the average user. Fortunately I only needed to find five files – data from a previous restore point - copy them to the CONFIG folders and rename them for use by Windows. These are the files Windows updates when it shuts down, so it can restore itself on the next boot. Now you know why you can't just shut the computer off.
The items you're looking for in a recent (but not with today's date!) sub-folder of the SIV are named
Note where most files say machine in the name, one says user. You rename them to :
(i.e. delete the prefix on each) Then copy them over to c:\windows\system32\config\
If you think you can jump ahead a step and save yourself a lot of problems by copying the files now while your system is working properly, think again. Because the files are constantly in use, Windows XP won't let them be copied, even through the CMD window. You have to boot from a floppy or the install disk to be able to do it. (In order to boot from CD, you will have to change your BIOS setup, otherwise you'll keep booting from the hard drive. And don't forget to change it back after you've finished, so you don't boot from the CD in future.)
A small trick: create a system restore point, then copy these files from the SVI to another directory, and rename them there. Copy and rename these files after every time you create a restore, so the data is up to date. Makes it easier than trying to fiddle with the SVI each time you have to recover.
Anyway, once the files were copied, I removed the drive from the second computer, reset it to master, put it back into the P4 and rebooted my system. All in all, tinkering, moving drives, backing up data and making fixes took about six hours. The better part of a working day spent on one problem.
I also took the precaution of making a backup of those five config files and placed them in a directory where I could access them more easily in future. And then I copied the files to the Windows repair folder, overwriting the older files in it. That way if the problem happens again I can copy system files from a more current configuration, and not have to go back to the beginning again.
I was lucky – at least according to some of the horror stories I’ve read online – my hacking worked and my computer was back up with nothing lost or uninstalled - that I've managed to find yet. I’ve read tales of this error coming back with every reboot, of it recurring at random but frequent intervals.
The cause of the crash? No one knows. Too much stuff going on is one suggestion. One forum thread mentioned it happened when users had seven or more IE windows open at any one time. Since I often surf deeply (meaning opening new windows to follow links), I often have many IE windows open at once. Seven or more? I've had a dozen open. Is it IE or any application? Will IE7 or Firefox, with their tabbed windows prevent this?
Another solution for repair mentioned on the various forums is to boot from a Bart PE drive. I agree: This can be very useful, since it opens up your system without affecting files on your hard drive. The main problem is that it takes a modestly high level of technical savvy to build a Bart PE disk. However, it may be worthwhile to have a computer technician build one so you can have one on hand should you need it. You will still need to access the SVI and copy its files when you boot with Bart, however.
The lesson for today is: back up more frequently, use System Restore more often and copy those critical configuration files to a safe place where they can be used to restore your system in the future because from all accounts, this is will happen again under Windows XP. And sacrifice the occassional goat to the demiurge Bill Gates to propitiate him and hope he doesn't punish you again...
[/indent]
Last Saturday, a P4 system in the store, a computer that has worked flawlessly for the past year and a bit, refused to boot.
Quote
“Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM”
I had never heard of this particular error (Windows has some many, keeping track of a few seems to occupy most of my effort...), but files do get corrupt. These files are constantly updated by Windows to track how everything is put together on your system, so they are particularly vulnerable to write errors I suppose.
The next screen advised me to use the repair feature on the Windows CD, but that has limitations, not least of all that it can act like a time machine and send you back to your first moment of installation (and that means having to re-install pretty much everything on your system, from patches to applications).
My newest computer allows up to 8 IDE devices, not the standard four that most PCs have. These extra IDE devices are controlled through a second chip on the motherboard, not through the BIOS. Windows’ repair feature can only see the BIOS devices, so my hard drive was invisible to it. The repair console couldn't find the damned drive!
Windows wouldn’t boot, so the system restore feature was equally unattainable. I needed to find another solution.
This was critical because the computer in question was not only the repository of my accounting and financial data, but it also contained the hard disk of customer files – artwork, graphics, business cards, and many ongoing projects. I had backups, but they were usually done on the weekend – and the computer failed Saturday. A week’s worth of work and data - and maybe more - was lost unless I could recover it.
I started searching online. I had expected this was a rare event, like winning the lottery in reverse. Instead, I discovered hundreds of entries about it; on forums I read dozens of tales of woe about people encountering this crash, plus pages of repair advice such as Schrock Innovations and Kelly's Korner, even a blog site about it.
Microsoft has a page on fixing it: five pages of mind-numbing technical data and instructions the average person would probably not comprehend. These instructions include accessing the normally hidden and inaccessible “System Volume Information” folder, which is one of those areas even technophiles fear to tread. Even the 'simplifed' instructions on other sites were awash in geek-ese. What the hell is a "software hive"? It sounds like insects are living in my computer!
For something that requires a modestly complex resurrection method and a healthy technical aptitude, this appears to be a fairly common event. On many technical forums it was one of the hot topics, with lots of useless palaver, but not much help. I had to sift through reply after reply until I could find clues as to how I might restore everything, and then carefully compare the instructions to make sure nothing was omitted or lost in translation.
First, I removed the drive and placed it into another computer as a slave drive, then checked its integrity for bad sectors. Fortunately, the hardware was okay. The files Windows kept saying were missing or corrupt were there, on the drive, easily visible in Explorer, so the problem must have been internal to one of them.
I took the opportunity at this point to copy critical data such as my accounting database, and my customer files, over to other computers on my network, just in case. Programs I can always re-install, but data I can't reconstruct, or can't do so without an enormous amount of effort.
Following Microsoft's instructions, I renamed the old CONFIG directory and copied files from Windows’ backup CONFIG directory (c:\windows\repair\). But te files there are dated from when I first installed Win XP. This got me thinking about what I was doing here.
The problem with this approach is that it overwrites all your data with basic or older system files that have no information about your current system: all your applications become 'uninstalled,' all your network connections are lost, and previously happy hardware vanishes… it requires restoring and re-installing pretty much everything from scratch. That would take many, many hours. If you reboot at this point, you can end up back at the point where you first installed Windows XP.
Instead, I had to dive into the System Volume Information (SVI) folder, where the secret repository of system restore data is hidden. This isn’t easy, because Windows resists all efforts to unlock it on any drive, not merely the boot drive.
Once again I had to surf over to Microsoft for some help on just how to do this.
Changing the SVI folder settings requires first making hidden files visible, then using a command-line attribute change to be able to open it. This has to be done in a CMD window and you need to know the name of the user who will be doing this. The command line to unlock the SIV folder is this:
cacls "driveletter:\System Volume Information" /E /G "username:F"
Type it like that, changing drivename to your main drive letter (usually C:) and the username to whatever that is (when you open the CMD window, it usually starts in the document folder, so the name of the current user is probably in the command prompt line). Don't forget the quote marks around the name and username (if you have problems, drop the quotes from the username, but I have found they are necessary).
The SVI folder is a lot like the registry: full of files and data incomprehensible to the average user. Fortunately I only needed to find five files – data from a previous restore point - copy them to the CONFIG folders and rename them for use by Windows. These are the files Windows updates when it shuts down, so it can restore itself on the next boot. Now you know why you can't just shut the computer off.
The items you're looking for in a recent (but not with today's date!) sub-folder of the SIV are named
_REGISTRY_USER_.DEFAULT _REGISTRY_MACHINE_SECURITY _REGISTRY_MACHINE_SOFTWARE _REGISTRY_MACHINE_SYSTEM _REGISTRY_MACHINE_SAM
Note where most files say machine in the name, one says user. You rename them to :
DEFAULT SECURITY SOFTWARE SYSTEM SAM
(i.e. delete the prefix on each) Then copy them over to c:\windows\system32\config\
If you think you can jump ahead a step and save yourself a lot of problems by copying the files now while your system is working properly, think again. Because the files are constantly in use, Windows XP won't let them be copied, even through the CMD window. You have to boot from a floppy or the install disk to be able to do it. (In order to boot from CD, you will have to change your BIOS setup, otherwise you'll keep booting from the hard drive. And don't forget to change it back after you've finished, so you don't boot from the CD in future.)
A small trick: create a system restore point, then copy these files from the SVI to another directory, and rename them there. Copy and rename these files after every time you create a restore, so the data is up to date. Makes it easier than trying to fiddle with the SVI each time you have to recover.
Anyway, once the files were copied, I removed the drive from the second computer, reset it to master, put it back into the P4 and rebooted my system. All in all, tinkering, moving drives, backing up data and making fixes took about six hours. The better part of a working day spent on one problem.
I also took the precaution of making a backup of those five config files and placed them in a directory where I could access them more easily in future. And then I copied the files to the Windows repair folder, overwriting the older files in it. That way if the problem happens again I can copy system files from a more current configuration, and not have to go back to the beginning again.
I was lucky – at least according to some of the horror stories I’ve read online – my hacking worked and my computer was back up with nothing lost or uninstalled - that I've managed to find yet. I’ve read tales of this error coming back with every reboot, of it recurring at random but frequent intervals.
The cause of the crash? No one knows. Too much stuff going on is one suggestion. One forum thread mentioned it happened when users had seven or more IE windows open at any one time. Since I often surf deeply (meaning opening new windows to follow links), I often have many IE windows open at once. Seven or more? I've had a dozen open. Is it IE or any application? Will IE7 or Firefox, with their tabbed windows prevent this?
Another solution for repair mentioned on the various forums is to boot from a Bart PE drive. I agree: This can be very useful, since it opens up your system without affecting files on your hard drive. The main problem is that it takes a modestly high level of technical savvy to build a Bart PE disk. However, it may be worthwhile to have a computer technician build one so you can have one on hand should you need it. You will still need to access the SVI and copy its files when you boot with Bart, however.
The lesson for today is: back up more frequently, use System Restore more often and copy those critical configuration files to a safe place where they can be used to restore your system in the future because from all accounts, this is will happen again under Windows XP. And sacrifice the occassional goat to the demiurge Bill Gates to propitiate him and hope he doesn't punish you again...
[/indent]
This posting allows me to express a thought that I was tempted to mention in commenting on your earlier post regarding editing and the apparent erosion of concern about correct usage of language.
Much of my background is in the area of specialized application software development. In the early days, when software was released, it was expected to be bug free. Errors which were found and required “fixes” were a major embarrassment to the developer. Competitors were quick to broadcast through every means available that the offending problem rendered the software in question unreliable and the developer unworthy of patronage. This, no matter how good the overall product was or how adept the author was at reacting to the users by supplying information and updates.
Gradually, toleration for instability became the norm. Beta testing in the marketplace was regarded as a privilege rather than an imposition. Suppliers of software provided great lists of problems, fixes and hacks. “Heat Seekers” everywhere got to participate in the polishing of virtually every piece of operating and application software.
I regard the era of striving for perfection prior to release as part of the past. Today, many would argue the importance of getting things to market so that they can be reflected on a company’s bottom line. And, the fact that users everywhere can get the benefits of the new and improved sooner, far outweighs the inconvenience and stress you experienced during your recent episode.
Maybe today I will give some more thought to upgrading my ME to XP. Of course this would require learning a new set of idiosyncrasies. The good news is that apparently, if I decide to do this and run into problems, I now know who to call.